Is BattleTabs safe?
BattleTabs is medium risk. Opening a new tab, BattleTabs checks a URL stored by its own servers. If set, it redirects the tab there immediately, with no domain restriction or prompt. The destination is whatever the GraphQL server last pushed into settings, unchecked.
Who publishes itGangbusters Ltd - 1 other listing from the same operator, none carrying a finding
Gangbusters Ltd - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same operator - 1 listing
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Server-controlled new-tab redirect via GraphQL settings
Opening a new tab, BattleTabs checks a URL stored by its own servers.
If set, it redirects the tab there immediately, with no domain restriction or prompt.
The destination is whatever the GraphQL server last pushed into settings, unchecked.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You open a new tab.
Any new tab load triggers the BattleTabs newtab.html override before any content appears.
The extension reads a server-supplied URL from local storage and redirects the tab to it, no prompt, no domain check.
chrome.tabs.update({url: newTabReplacementUrl}) fires unconditionally if the setting is non-null. The URL came from the BattleTabs GraphQL server in your last Me @live response.
New-tab redirect, shipped vs deobfuscated
async function Bf() { return new Promise((e, t) => { chrome.storage.local.get(qo, n => { let r = n[qo]; if (r && r.newTabReplacementUrl && window.location.hash == "") { let o = String(r.newTabReplacementUrl); chrome.tabs.update({ url: o.includes("://") ? o : `https://${o}` }).catch(console.error) } else e() }) })}Stores user settings, including the server-pushed redirect URL. Any non-null newTabReplacementUrl is applied to every new tab.
- Location
- chrome.storage.local key "Storage_v3"
{ "musicEnabled": true, "soundsEnabled": true, "newTabReplacementUrl": "https://battletabs.com/promo/seasonal-event-2026", "nativeNotificationsEnabled": true}- battletabs.fly.dev
BattleTabs GraphQL API. Returns user settings, including newTabReplacementUrl, via the Me @live subscription. A server compromise grants control over new-tab navigation.
Injects a test URL into chrome.storage.local["Storage_v3"].newTabReplacementUrl via the Chrome DevTools Protocol and verifies that the next new tab load calls chrome.tabs.update with that URL.
- Chrome with BattleTabs (mjcklhnhfiepmofggcoegkmkokbljmjd) installed
// Reproducer: verify BattleTabs new-tab redirect via storage injection// Run in the browser console on the extensions page, or via CDP.//// 1. Inject canary URLconst STORAGE_KEY = "Storage_v3";const TEST_URL = "https://example.com/redirect-test-" + Date.now();chrome.storage.local.get(STORAGE_KEY, (current) => { const updated = { ...(current[STORAGE_KEY] || {}), newTabReplacementUrl: TEST_URL }; chrome.storage.local.set({ [STORAGE_KEY]: updated }, () => { console.log("[reproducer] Injected newTabReplacementUrl:", TEST_URL); console.log("[reproducer] Open a new tab — it should navigate to the canary URL."); });});// 2. To clean up after testing:// chrome.storage.local.get("Storage_v3", (d) => {// const c = { ...d["Storage_v3"] };// delete c.newTabReplacementUrl;// chrome.storage.local.set({ "Storage_v3": c });// });- 1Open chrome://extensions, enable Developer Mode, click 'background page' for BattleTabs.
- 2Paste the script into the console.
- 3Open a new tab.
- 4Observe the tab redirects to the test URL with no user prompt.
What it can do
Permissions this extension asks for, as declared in version 52.25.0.3427. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
Show you desktop notifications
notifications
Read the sites you visit most
topSites